Re: [PATCH] tpm: efi: reject a final events table with an oversized preboot log

[Ard Biesheuvel]

On Fri, 6 Nov 2026, at 02:49, Guo Zihao wrote:
> The preboot portion recorded in the main event log is subtracted from
> the size of the final events table taken from the firmware:
>
> 	/*
> 	 * The 'final events log' size excludes the 'final events preboot log'
> 	 * at its beginning.
> 	 */
> 	final_events_log_size -= log_tbl->final_events_preboot_size;
>
> Both sizes come from EFI configuration tables and are not validated
> against each other. A final events table claiming a preboot portion
> larger than the table itself makes final_events_log_size go negative:
> the subsequent devm_krealloc() can then end up with a wrapped, too
> small allocation, and the memcpy() that appends the final events log
> uses the negative value as its length, running far past the buffer.
>
> The boot path has no way to fix up such a table, so fail the final
> events log instead of appending from it.
>
> Fixes: 166a2809d65b ("tpm: Don't duplicate events from the final event 
> log in the TCG2 log")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
> ---
>  drivers/char/tpm/eventlog/efi.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/char/tpm/eventlog/efi.c b/drivers/char/tpm/eventlog/efi.c
> index 4e9d7c2bf..0a8006f3e 100644
> --- a/drivers/char/tpm/eventlog/efi.c
> +++ b/drivers/char/tpm/eventlog/efi.c
> @@ -82,6 +82,9 @@ int tpm_read_log_efi(struct tpm_chip *chip)
>  		goto out;
>  	}
> 
> +	if (log_tbl->final_events_preboot_size > final_events_log_size)
> +		goto out;
> +

Should we add a pr_warn() here?